Security update for memcached SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0955-1 Final 1 1 2018-04-16T15:31:41Z current 2018-04-16T15:31:41Z 2018-04-16T15:31:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for memcached This update for memcached fixes the following issues: - CVE-2018-1000115: Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server could result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). (bsc#1083903) - Home directory shouldn't be world readable bsc#1077718 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-SP3-2018-647 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180955-1/ Link for SUSE-SU-2018:0955-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003893.html E-Mail link for SUSE-SU-2018:0955-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1077718 SUSE Bug 1077718 https://bugzilla.suse.com/1083903 SUSE Bug 1083903 https://www.suse.com/security/cve/CVE-2018-1000115/ SUSE CVE CVE-2018-1000115 page SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 memcached-1.4.39-4.6.1 memcached-1.4.39-4.6.1 as a component of SUSE Linux Enterprise Server 12 SP3 memcached-1.4.39-4.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default. CVE-2018-1000115 SUSE Linux Enterprise Server 12 SP3:memcached-1.4.39-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:memcached-1.4.39-4.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180955-1/ https://www.suse.com/security/cve/CVE-2018-1000115.html CVE-2018-1000115 https://bugzilla.suse.com/1083903 SUSE Bug 1083903